Siemens has publicly acknowledged fifteen (15) vulnerabilities within their very popular SINEC network management system (NMS), with two (2) of the flaws being especially troubling. If successfully exploited, these vulnerabilities could allow attackers to steal sensitive data, perform denial-of-service (DoS) attacks, and conduct remote code execution (RCE). SINEC is an industrial control management system used to centrally manage and automate industrial networks with tens of thousands of different nodes. The two (2) vulnerabilities of note were identified by researchers from Claroty’s Team82 and are exploited in sequence as part of an attack chain. The first vulnerability in the chain, tracked as CVE-2021-33723, is described as an account takeover through improper authorization flaw, and allows unauthenticated users to gain access to the SINEC administrator’s account by exploiting a flaw in the way that users are allowed to edit their own account details on the server. The problem is that the server does not validate that the user sending the edit profile request for an administrator account is actually an administrator. This allows an attacker to change the password via a malicious JSON payload, giving themselves unrestricted administrator permissions. The second vulnerability in the chain, tracked as CVE-2021-33722, is a RCE through a path traversal flaw, which allows the attackers to access restricted directories. As part of the platform’s business logic, SINEC allows users with administrator access to create bundles of files in a container and then send that container to any device on the network. With the attackers having already gained administrative access, they can create a container containing a malicious file or webshell and drop it on the hosting server’s filesystem. The attackers can then export the container to any directory that they name by supplying path traversal characters, allowing them to copy those files to arbitrary locations on the filesystem, and then execute them remotely. The fifteen (15) vulnerabilities have all been successfully patched by Siemens, and CTIX analysts urge all administrators to ensure their infrastructure is up to date. The proof-of-concept (PoC) exploit by Team82 can be found in the report linked below, as well as the specifics on the other thirteen (13) less severe vulnerabilities.